Required Firewall Configuration

To ensure the seamless operation and reliability of our voice services (available via phone, softphone, and web interfaces), correct firewall and network configuration is essential. This guide consolidates all required IP addresses, ports, and critical SIP-ALG settings.

Our services rely on DNS-SRV and domain name translation for robust communication between servers. The server IPs listed below are subject to change as we expand. Please refer to this document periodically for the latest configuration details.

1. IP Addresses to Whitelist

Failure to whitelist these IP addresses may severely disrupt your service and reduce its ability to withstand outages.

Please ensure the following IP ranges are allowed through your firewall:

• 64.26.133.64/27

• Firmware repository IP addresses:

  • Using URL: phones-firmware.ucstack.io

2. Required Ports for Communication

Ensure the following TCP and UDP ports are permitted for communication with our servers.

TCP Ports:

• 80 & 443: For web UI and secure web services (HTTP/HTTPS).

• 5060: For SIP signaling.

• 5061: For secure SIP signaling over TLS.

• 8001: For WebSocket communications (e.g., Management Portal, Web Phone, Video Portal).

• 9002: For WebSocket communications (e.g., Web Phone, Video Portal).

UDP Ports:

• 5060: For SIP signaling.

• 20000-27999: For inbound RTP media traffic (audio/video streams). Some configurations may require up to port 30000.

3. Critical: Disable SIP-ALG (Session Initiation Protocol Application Layer Gateway)

You must disable SIP-ALG for any VoIP service to operate as expected. This feature is enabled by default on many routers, firewalls, modems, and some managed switches. SIP-ALG attempts to modify SIP packets with the router's own details, which breaks standard VoIP communication.

Common Symptoms of SIP-ALG Being Enabled:

• Phones dropping registration.

• Calls going straight to voicemail for no apparent reason.

• Calls dropping after a certain period, when retrieved from hold, or when transferred.

• Inability to make outbound calls or receive inbound calls (phone doesn't ring).

• Calls with no audio or one-way audio.

• Other extensions continue ringing after a call has been answered.

• Call connectivity issues during transfers (parties cannot hear each other).

Action Required: Locate and disable the SIP-ALG setting in your router/firewall's administrative interface.

Summary

For optimal performance and to prevent service disruptions, please:

1. Whitelist the three IP ranges listed above.

2. Open the specified TCP and UDP ports.

3. Disable SIP-ALG on your network edge device.

Adhering to these specifications will mitigate common call-related issues and ensure a high-quality, reliable communication experience with our voice services.

4. SIP-ALG Test

You can run a test for SIP-ALG here: http://mcstest.visualware.com/myspeed/myvoiph5_g711_sipalg.html

This test requires you to download a small utility called BCS.

Once on the SIP ALG Test page, click on:

The test result must return SIP ALG Firewall: N as showed in this figure:

If the result is "SIP ALG Firewall: Y", you must speak to IT technician who has access into the internet router to deactivate this feature and then repeat the test.

Consistent NAT must be turned on

Firewalls that don't utilize Consistent NAT can block incoming Whitelistcalls because they dynamically change the public IP port used for communication. If a call arrives before the system is updated with the new IP port assigned by the firewall, the call won't reach the intended device. To avoid this, enable Consistent NAT in your firewall settings.